CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 1660 | CVE-2000-0082 | Candidate | WebTV email client allows remote attackers to force the client to send email without the user"s knowledge via HTML. | Modified (20040901) | MODIFY(1) Frech | REJECT(1) Baker | CHANGE> [Frech changed vote from REVIEWING to MODIFY] | Frech> ADDREF XF:webtv-hijack-mail-forward | View |
| 2310 | CVE-2000-0734 | Candidate | eEye IRIS 1.01 beta allows remote attackers to cause a denial of service via a large number of UDP connections. | Proposed (20000921) | MODIFY(1) Levy | NOOP(2) Cole, Wall | REJECT(1) Frech | Levy> The product is in wide use even while is in beta. eEye brought another company and made all their previous customers upgrade to the new software. | View |
| 520 | CVE-1999-0523 | Candidate | ICMP echo (ping) is allowed from arbitrary hosts. | Proposed (19990726) | MODIFY(1) Meunier | NOOP(1) Baker | REJECT(2) Frech, Northcutt | Northcutt> (Though I sympathize with this one :) | CHANGE> [Frech changed vote from REVIEWING to REJECT] | Frech> Ping is a utility that can be run on demand; ICMP echo is a | message | type. As currently worded, this candidate seems as if an arbitrary | host | is vulnerable because it is capable of running an arbitrary program | or | function (in this case, ping/ICMP echo). There are many | programs/functions that | "shouldn"t" be on a computer, from a security admin"s perspective. | Even if this | were a vulnerability, it would be impacted by CD-HIGHCARD. | Meunier> Every ICMP message type presents a vulnerability or an | exposure, if access is not controlled. By that I mean not only those | in RFC 792, but also those in RFC 1256, 950, and more. I think that | the description should be changed to "ICMP messages are acted upon | without any access control". ICMP is an error and debugging protocol. | We complain about vendors leaving testing backdoors in their programs. | ICMP is the equivalent for TCP/IP. ICMP should be in the dog house, | unless you are trying to troubleshoot something. MTU discovery is | just a performance tweak -- it"s not necessary. I don"t know of any | ICMP message type that is necessary if the network is functional. | Limited logging of ICMP messages could be useful, but acting upon them | and allowing the modification of routing tables, the behavior of the | TCP/IP stack, etc... without any form of authentication is just crazy. | View |
| 1636 | CVE-2000-0058 | Candidate | Network HotSync program in Handspring Visor does not have authentication, which allows remote attackers to retrieve email and files. | Proposed (20000125) | MODIFY(2) Baker, Frech | NOOP(1) Christey | Frech> XF:handspring-visor-auth(3873) | Consider removing the security-express.com reference, since it is identical | to the BugTraq reference. The BugTraq reference is (hopefully) not going to | disappear soon, and the security-express.com reference provides no new or | additional information. | Christey> URLs will begin to be included with candidates to support | Board members" voting activities. They will be converted to | the generalized reference format when if candidate is | ACCEPTed and becomes an official entry. | Christey> The problem may not be a lack of authentication (as mentioned | by the poster), but rather weak authentication (the apparent | need to provide the same username). | Baker> MOdify description to indicate the weak authentication | View |
| 1662 | CVE-2000-0084 | Candidate | CuteFTP uses weak encryption to store password information in its tree.dat file. | Proposed (20000125) | MODIFY(2) Baker, Frech | NOOP(1) Christey | Frech> XF:cuteftp-weak-encrypt(3910) | Christey> BUGTRAQ:20010823 Re: Respondus v1.1.2 stores passwords using weak encryption | URL:http://marc.theaimsgroup.com/?l=bugtraq&m=99861651923668&w=2 | This followup to a different thread mentions the sm.dat file | for the site manager. | Baker> The reference from the Bugtraq mentions the sm.dat uses better encryption, but doesn"t really address the tree.dat file. | View |
Page 1156 of 20943, showing 5 records out of 104715 total, starting on record 5776, ending on 5780
